@chatpanel/pii 0.2.14 → 0.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chatpanel/pii",
-  "version": "0.2.14",
-  "description": "The canonical ChatPanel privacy engine — reversible PII redaction + pseudonymization with local entity detection. Pure, dependency-free ESM shared by the ChatPanel extension, gateway, and bridge.",
+  "version": "0.3.0",
+  "description": "The canonical ChatPanel privacy engine \u2014 reversible PII redaction + pseudonymization with local entity detection. Pure, dependency-free ESM shared by the ChatPanel extension, gateway, and bridge.",
   "type": "module",
   "main": "index.js",
   "exports": {

package/pii-redact.js

@@ -345,3 +345,47 @@ export function hasToken(text) {
   TOKEN_RE.lastIndex = 0;
   return TOKEN_RE.test(String(text || ''));
 }
+
+// ── What was redacted, for the user's own eyes ──────────────────────────────────────────
+//
+// The privacy promise is invisible unless you can SEE it: which entity types were caught,
+// how many of each, and (on request) the actual before → after pairs. All of that already
+// exists in the vault — this just summarises it, so every client renders the same shape
+// instead of each one re-deriving it.
+//
+// PRIVACY OF THE SUMMARY ITSELF: `types` carries counts only, never values, so it is safe
+// to render, log or persist. Real values live behind `pairs`, which a caller must ask for
+// explicitly (`includeValues: true`) — they are the user's own data, shown on their own
+// device, and must never be written anywhere durable.
+
+/** Entity type + count for everything this vault redacted, most-frequent first. */
+export function redactionSummary(vault, { includeValues = false, maxPairs = 200 } = {}) {
+  const byType = new Map();
+  const pairs = [];
+  for (const [token, value] of vault?.byToken || new Map()) {
+    const m = /^\[\[([A-Z][A-Z0-9]*)_(\d+)\]\]$/.exec(token);
+    const type = m ? m[1] : 'OTHER';
+    byType.set(type, (byType.get(type) || 0) + 1);
+    if (includeValues && pairs.length < maxPairs) pairs.push({ token, value, type });
+  }
+  const types = [...byType.entries()]
+    .map(([type, count]) => ({ type, count }))
+    .sort((a, b) => b.count - a.count || a.type.localeCompare(b.type));
+  return {
+    total: types.reduce((n, t) => n + t.count, 0),
+    types,
+    ...(includeValues ? { pairs } : {}),
+  };
+}
+
+/** Merge several vault summaries (e.g. every conversation) into one. Counts only. */
+export function mergeRedactionSummaries(summaries) {
+  const byType = new Map();
+  for (const s of summaries || []) {
+    for (const t of s?.types || []) byType.set(t.type, (byType.get(t.type) || 0) + t.count);
+  }
+  const types = [...byType.entries()]
+    .map(([type, count]) => ({ type, count }))
+    .sort((a, b) => b.count - a.count || a.type.localeCompare(b.type));
+  return { total: types.reduce((n, t) => n + t.count, 0), types };
+}

package/tool-harness.js

@@ -77,6 +77,16 @@ export function placeholderToolNote({ toolData = 'real' } = {}) {
   return intro + remote + rules;
 }
 
+// Tools whose results come from the PUBLIC web rather than from the user's own machine or
+// accounts. Deliberately a short, explicit allowlist rather than a heuristic: being wrong in
+// the "public" direction would send real PII to a model, so a tool earns its place here only
+// when its output is public by construction. Page tools are NOT here — the user's open tab
+// may be an internal app.
+const PUBLIC_SOURCE_TOOLS = new Set(['web_search', 'web_fetch', 'fetch_url']);
+export function isPublicSourceTool(name) {
+  return PUBLIC_SOURCE_TOOLS.has(String(name || '').toLowerCase());
+}
+
 export function makeToolHarness({ vault = null, toolData = 'real', redactOpts = null, redactResults = true, remoteTools = null } = {}) {
   const on = !!vault;                       // privacy enabled for this turn?
   const redactRemote = toolData === 'redactRemote';
@@ -109,6 +119,19 @@ export function makeToolHarness({ vault = null, toolData = 'real', redactOpts =
     // via a nested field the old string/{text}-only path skipped.
     toModelResult(name, raw) {
       if (!on || !redactResults || !redactOpts) return raw;
+      // PUBLIC RESULTS ARE NOT THE USER'S DATA.
+      //
+      // Redaction exists to stop the user's information LEAVING the device. Text coming back
+      // from a public web search never left it — the model's provider could fetch the same
+      // page itself — so rewriting it buys no privacy and actively corrupts facts: a
+      // dictionary pseudonym (Suresh → John) renamed a public actor inside search results,
+      // and the answer came back about "Mysore Seshaiah John Babu Naidu". The detectors
+      // (emails, phones, keys) also fire on unrelated strangers' details in fetched pages.
+      //
+      // So public-source results pass through intact. Everything local or private — history,
+      // meetings, notes, the user's own page, any MCP server — is redacted exactly as before,
+      // which is where a leak could actually happen.
+      if (isPublicSourceTool(name)) return raw;
       return redactResultShape(raw, vault, redactOpts);
     },